요약정리 7

보안약점을 보완하기 위한 (예시)코드를 제시하시오.

크로스사이트 스크립트

String name = request.getParameter("name");
if (name != null) {
    name = name.replaceAll(_________, _________);
    name = name.replaceAll(_________, _________);
    name = name.replaceAll(_________, _________);
    name = name.replaceAll(_________, _________);
} else { 
    name = "";
}

 

SQL 삽입

String author = request.getParameter("authorName");
if (author == null || "".equals(author)) return;
author = author.replaceAll(__________, __________);
author = author.replaceAll(__________, __________);

 

솔트 없이 일방향 해쉬 함수 사용

MessageDigest digest = MessageDigest.getInstance("SHA-255");
digest.reset();
digest.__________(salt);
digest.digest(password.getBytes("UTF-8"));

 

Public 메소드로부터 반환된 Private 배열

private String[] colors;
public String[] getColors() {
    String[] ret = null;
    if (this.colors != null) {
        _______________ = new String[_______________];
        for (int i = 0; i < _______________; i++) { 
            _______________[i] = _______________[i]; 
        }
    }
    return ret;
}

 

Private 배열에 Public 데이터 할당

private String[] userRoles;
public void setUserRoles(String[] userRoles) {
    if (userRoles != null) {
        _______________ = new String[_______________];
        for (int i = 0; i < _______________; ++i) {
            _______________[i] = _______________[i];
        }
    }
}